AI Governance for a Business of One to Ten People, the Lightweight Version

Say 'AI governance' to a small business owner and you can watch their eyes glaze. It sounds like steering committees, risk registers and a consultant on retainer, machinery built for companies with a floor full of lawyers. But here is the number that matters: according to the ABS, around 12 per cent of Australian businesses were using AI in their workplace in 2024 to 2025, with adoption among small and micro businesses at around 11 per cent, up from very low single digits just two years earlier. The tools have arrived in small business. The rules mostly have not.

And small business is the country. ASBFEO data shows 97.3 per cent of Australian businesses are small businesses, 64 per cent have no employees at all and another 25 per cent employ just one to four people. Almost every piece of governance advice ever written was aimed at the other few per cent. This article is the version for the rest of us: three lists and one habit, on one page, done in about 30 minutes.

What governance means when you can see everyone's desk

Strip away the corporate theatre and governance is three questions. What AI tools are we using? What information are we putting into them? Who checks the output before it reaches a client? If you can answer all three without guessing, you already have governance, you just have not written it down. Writing it down is what turns a vibe into a rule: something you can hand to a new hire, point to when something goes wrong, and actually enforce.

Why bother at all? Because the two risks that can genuinely hurt a business your size are specific and boring. The first is client information leaking into tools that were never meant to hold it. The second is AI generated output, a quote, a report, an email with an invented number in it, going out the door with your name on it, unchecked. Neither risk needs a committee. Both need a rule that everyone, including you, actually follows.

There is also a telling detail in the ABS data: among innovation active small businesses, AI adoption is 19 per cent, almost five times the rate of small businesses that do not innovate. The businesses moving fastest on AI are precisely the ones accumulating risk fastest. If you are reading this, you are probably in that group. Good governance is not a handbrake on that momentum; it is what lets you keep accelerating without checking the mirrors every five minutes.

List one: the tools you actually use

Open a document and write down every AI tool in use in your business right now, including the ones you suspect your staff use without telling you. Personal ChatGPT accounts on work laptops count. For each tool, note who holds the login and whether it is a personal or business account. Then decide which tools are approved for client work, and put those on a paid business tier where the provider offers stronger data controls. The rule that makes the list work is simple: if the tool is not on the list, ask before you paste.

List two: the red lines, what never goes in

This is the list that protects you. Client identifiable information. Financial records. Anything covered by a non disclosure agreement. Health or legal matters. Staff personal details. Whatever your formal obligations under the Privacy Act turn out to be at your size, your clients' expectation is much simpler: the information they gave you stays with you. A three person firm does not get a second chance at that reputation.

The practical middle path is de identification. You can still use AI on client work, swap names for role labels, round the numbers, strip the details that identify anyone, and you lose almost none of the usefulness. 'Draft a payment reminder for a commercial client 60 days overdue on a five figure invoice' gets you the same letter as pasting the real ledger, without the exposure.

List three: the sign off rule

Write this sentence at the bottom of the page: AI drafts, a human signs. Anything client facing, financial or irreversible gets read, properly read, by a person who understands it before it goes out, and the person who sends it owns it. The failure mode this prevents is well documented: AI systems produce confident, plausible, wrong details, and the ones that slip through are usually numbers, names and dates. If you work alone, the rule becomes a self checklist: before sending, verify every figure against the source document, check every name, and read the whole thing once as if you were the recipient.

The 30 minute quarterly habit

A governance page written once and never reopened is worse than nothing, it gives you the feeling of control without the fact of it. So the final piece is a recurring 30 minute calendar appointment, once a quarter, with three agenda items: what tools have crept in since last time, what near misses happened, and what new parts of the business now touch AI. Update the page, then get back to work. The cadence is the governance. The document is just where it lives.

Here is the thing you can do today: open a blank document and write the three lists, tools we use, information that never goes in, outputs that need a human signature. Twenty minutes, one page, and you will have more functioning AI governance than most businesses ten times your size.

And if you want a second head on it, someone to pressure test the red lines, the tool choices and the judgement calls that follow, that is precisely what ProjxAI's CEO AI coaching is for: a standing session where an experienced operator works through decisions like these with you, at the pace of a business your size. The one page policy is the start. Knowing which calls to make next is the part that compounds.